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United States of America ) 
v. ) 
Case No. 
HOUCINE BECHIR GHOUL ) . . Ow ae 
) 
) 
Defendant(s) 
CRIMINAL COMPLAINT 
I, the complainant in this case, state that the following is true to the best of my knowledge and belief. 
On or about the date(s) of February 21, 2017 in the county of Wake in the 
Eastern District of North Carolina , the defendant(s) violated: 
Code Section Offense Description 
Title 18 U.S.C. § 1425(a) Attempted Unlawful Procurement of Citizenship or Naturalization 
Title 26 U.S.C. § 7206(1) Filing False Tax Return 


This criminal complaint is based on these facts: 


See attached affidavit incorporated herein 


@ Continued on the attached sheet. 


CA : 


Complainant's signature 


on mis aay, SAHA LD FCI recourse vetore Amber L. Kilker, Special Agent, FBI 


me via reliable electronic means, was placed under oath, and Printed name and title 
attested to the contents of this Complaint. 


Date: 22 guy AT 


ge 's signatur, 


City and state: Raleigh, NC James E. Gates, U.S. Magistrate Judge 


Printed name and title 


yh 
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AFFIDAVIT IN SUPPORT OF 
CRIMINAL COMPLAINT AND ARREST WARRANT 


Your Affiants, 


AMBER L. KILKER, of the Federal Bureau of Investigation (FBI), 
and 
KEVIN GREENE, of the Internal Revenue Service (I.R.S), 


being first duly sworn, hereby depose and state as follows: 


Ha 
ay 


INTRODUCTION AND AGENT BACKGROUND 


This affidavit is submitted in support of the Criminal 
Complaint filed against HOUCINE BECHIR GHOUL, a/k/a HOUCINE 
GHOUL, a/k/a LIMBI GHOUL (hereinafter referred to as GHOUL). 


Based on the facts set forth in this affidavit, in addition 
to our training and experience, your affiants respectfully 
assert that there is probable cause to believe that GHOUL 
attempted to unlawfully procure naturalization in violation of 
Title 18, United States Code (U.S.C.), § 1425(a) and made false 
statements on tax returns in violation of Title 26 U.S.C. § 
7601(1). 


I, Amber Kilker, have been a Special Agent with the FBI since 
March of 2005 and have over 25 years of law enforcement 
experience. I am currently assigned to the Fayetteville 
Resident Agency, Charlotte Division, but prior to becoming an 
Agent with the FBI, I worked as an Agent with the U.S. Secret 
Service, and as an Officer/Detective with the Longmont Police 
Department, Longmont, Colorado. While assigned to the FBI, I 
have received training on and worked on a variety of federal 
criminal investigations. 


I, Kevin Greene, have been a Special Agent of the Internal 
Revenue Service ~ Criminal Investigation (IRS-CI) since April 
of 1991 and have nearly 30 years of experience in my career 
field. I joined the Examination Division of the IRS in November 
1988. In 1985, I earned a B.A. in Business Administration from 
the University of North Carolina at Charlotte. I have also 
completed additional training in accounting at the University 
of North Carolina in Greensboro. I investigate criminal 
violations of the Internal Revenue Code (Title 26 U.S.C.), the 
Bank Secrecy Act (Title 31 U.S.C.), Money Laundering (Title 18 
U.S.C. §§ 1956 & 1957), and related offenses. 
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5. The facts in this affidavit come from the personal 
observations of your affiants, our training and experience, 
examinations of reports and statements, interactions with 
witnesses, and conversations with other law enforcement agents. 
This affidavit is intended to show merely that there is 
sufficient probable cause for the requested Complaint and Arrest 
Warrant and does not set forth all of my knowledge about this 


matter. 
SUMMARY OF CRIMINAL CONDUCT 
6. As set out in greater detail below, on February 21, 2017, as 


a step toward obtaining United States citizenship, GHOUL 
completed an in person interview with an officer of the U.S. 
Citizenship and Immigration Services. During this interview, 
GHOUL provided multiple answers which he knew to be false. In 
particular, though not all inclusive, GHOUL falsely claimed i) 
that he had no association with any terrorist organizations, 
ii) that he had not committed any crimes for which he had not 
been arrested, iii) that he had never married anyone in order 
to obtain immigration benefits, and iv) that he supported the 
Constitution of the United States. In fact, GHOUL knew each of 
these to be false statements. 


7. As set out in greater detail below, GHOUL filed tax returns 
for 2015 and 2016 in which he knowingly and materially 
underreported his income, thereby avoiding the payment of income 
tax. 


FACTS IN SUPPORT OF REQUEST 


Investigation Initiation 


8. On April 4, 2014, a Confidential Human Source working with 
the FBI (hereinafter Source#1) provided the FBI with screenshots 
of Facebook! account 100006497799532, with an Arabic user name 
that once transliterated, is Abu Kindah, and in English, means 
“father of Kindah.” The account immediately appeared to be in 
support of the well-known terrorist group, The Islamic State in 
Iraq and al-Sham (ISIS)* because it used as its account cover 


l1 Facebook is an online social media platform. 


* On or about October 15, 2004, the United States Secretary of State designated 
al-Qaeda in Iraq (AQI), then known as Jam ‘at al Tawid wa’ al-Jahid, as a 
Foreign Terrorist Organization (FTO) under Section 219 of the Immigration and 
Nationality Act and as a Specially Designated Global Terrorist entity under 
section l(b) of Executive order 13224. On or about Mayl5, 2014, the Secretary 
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photo, a flag used by ISIS. Conduct by the user of this 
Facebook account additionally indicated support of terrorism. 
For example, one of the pages “liked”? by the user of this 
account featured photographs of Usama bin Laden and Abu Musab 
al-Zarqawi and had a title that translated to “Goodbye Dear 
Heroes.” 


of State amended the designation of AQI as an FTO under Section 219 of the 
Immigration and Nationality Act and as a Specially Designated Global Terrorist 
entity under section 1(b) of Executive Order 13224 to add the alias Islamic 
State of Iraq and the Levant (ISIL) as its primary name. The Secretary of State 
also added the following aliases to the FTO listing: The Islamic State of Iraq 
and al-Sham (“ISIS” — which is how the FTO will be referenced herein), The 
Islamic State of Iraq and Syria, ad-Dawla al-Islamiyya fi al-Iraq wa-sh-Sham, 
Daesh, Dawla al Islamiya, and Al-Furquan Establishment for Media Production. On 
September 21, 2015, the Secretary added the following aliases to the FTO 
listing: Islamic State, ISIL, and ISIS. To date, ISIS remains a designated FTO. 


3 Contained on the Facebook page account is one of the most recognizable symbols 
of ISIS - its black and white flag. The white banner at the top of the flag 
reads: “There is no god but Allah [God]. Mohammad is the messenger of Allah.” 
This phrase is a declaration of faith used across Islam, and is known as the 
shahada. Underneath is a white circle emblazoned with black writing reading 
"Mohammed is the messenger of God", which is meant to resemble the Prophet’s 
seal, similar to that used to close an envelope. There is an ancient tradition 
in the middle east of using a black flag with a white shahada inscription as a 
military ensign. This was adopted by the Taliban, then by Al-Qaeda in the 1990s 
and subsequently by the global jihadism movement involving various other groups, 
most prominently, ISIS. 


atasa 


Tineine About Photos Friends More 7 


4 A Facebook user can view contents of other Facebook accounts that are either 
publicly accessible or which have consented to this by virtue of accepting a 
“friend” request. Likewise, Facebook users can post comments on these other 
accounts or click a thumbs-up symbol to “like” items posted by these other 
users. 


5 Bin Laden is the well-known founder of the terrorist group, Al-Qaeda, who was 


killed in 2011. Zarqawi was a member of al-Qaeda who later formed al-Qeda in 
Iraq (AQI) and was killed in 2006. 


yE 
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9. The user had publicly listed a residence of Fayetteville, NC, 
and a hometown of Ghomrassen, Tunisia. 


10. On April 24, 2014, Source#l provided the FBI with a copy of a 
photograph that had been posted on the same Facebook page. The 
posting was not public, but Source#1 was able to view it because, 
as a Facebook “friend,” he had the ability to view the user's 
postings. The photo consisted of a black male standing in a 
convenience store and holding a makeshift sign written in black 
ink on the back of an opened cigarette carton (hereinafter “the 
NC photo”). Written on the carton in Arabic was the phrase “The 
American support for the Islamic State” and then below this in 
English was written, “ISIS,” and “N. Carolina, USA.” The black 
male is also holding up his right hand with his finger extended- 
a gesture associated with ISIS: 


\ 


at ST 
4 


LDL a 


ll. Facebook Records revealed that the account was created on 
August 12, 2013 and the account was associated with email 
account: ghoulaton@gmail.com. Google records related to this 
email address listed a secondary email account of 
ghoulaton@yahoo.com, and disclosed the account subscriber name 
as “Houcine Ghoul.” 


yee 
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12; 


6 


on 


Xi 


The Facebook Records additionally revealed that the account 
had been accessed from Internet Protocol (IP) address 
98.101.241.196.© Time Warner Cable records disclosed that this 
IP address resolved to a Days Inn located on Cedar Creek Road 
in Fayetteville, NC. 


Immigration Records 


Records from U.S. Citizenship and Immigration Services (USCIS) 
and U.S. Immigration and Customs Enforcement (ICE) disclosed 
that there was a Houcine GHOUL with a listed address of 2101 
Cedar Creek Road, Fayetteville, NC. This address is however a 
BP gas station located adjacent to the Days Inn previously 
noted. These records additionally disclosed that GHOUL had been 
born in Tataouine, Tunisia, in 1974. Moreover, these records 
confirmed that he was the father of a child named Kendah. 


On January 29, 2001, GHOUL entered the U.S. on a B2 Tourist 
Visa and was admitted until February 28, 2001. GHOUL overstayed 
his visa and on October 16, 2001, married M.T.. An I-130 
Petition for Alien Relative using M.T.’s name as sponsoring 
GHOUL was submitted on October 2, 2005 and approved on June 5, 
2007. However, on June 25, 2007, the United States Postal 
Service returned the approval notice as undeliverable. On or 
about March 29, 2006, GHOUL and M.T. were divorced.’ 


On January 31, 2007, GHOUL entered into a marriage with M.G., 
a U.S. Citizen from New York, NY. M.G. later filed an I-130 
Petition for Alien Relative for GHOUL on February 22, 2007. The 
I-130 was later approved by US Citizenship and Immigration 
Services (CIS) on June 30, 2009. 


On February 22, 2007, GHOUL submitted an I-485 Application to 
Register Permanent Residence or Adjust Status. The I-485 was 
later approved on September 18, 2009. GHOUL later divorced M.G. 
on May 28, 2010, less than one year after he obtained an approved 
I-485 and he adjusted to a Legal Permanent Resident. 


On July 17, 2010, GHOUL married M.B.G., a citizen and national 
of Tunisia. 


An IP address is a unique numerical identifier for a computer or device 
line. 


In contrast to Homeland Security information, in his N-400 filing, GHOUL 
sted his divorce from M.T. as January 3, 2007. 


ro 
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THE NC PHOTO 


18. An open search of social media sites using the term 
“ghoulaton” from GHOUL’s identified email accounts resulted in 
discovery of a Twitter® account with an Arabic username which 
transliterates to Abu Kindah al-Tunisi@ghoulaton. The account 
had a user profile photo of the ISIS flag. Twitter records 
confirm that this account was also linked to the email 
ghoulaton@gmail.com. Review determined that on April 23, 2014, 
the NC photo was tweeted from this account, with the comment 
translated from Arabic: “American Support for the State of Islam 
in Iraq and as-Sham”. 


19. On June 18, 2014, YouTube channel “Kata’ib al-Dawlah al- 
Islamiyah al-lliktruniyah” (ISIS Electronic Brigade) posted an 
Arabic Language video entitled “Billion-Muslims Campaign to 
support the Islamic State of Iraq and the Levant.” The video 
begins with an image of the upper torso of an individual wearing 
military fatigues bearing an insignia that reads “The Islamic 
State of Iraq and the Levant.” Next to this is a banner stating 
the name of the video and bearing the date 20 June 2014. The 
video is a compilation of photographs of handwritten notes or 
people showing support for ISIS. Some of these photographs are 
taken in front of visibly recognizable iconic landmarks, such 
as the Eiffel Tower. Other locations are identifiable because 
the individuals espousing support hold a sign indicating their 
locations.?® Approximately 3 minutes and 20 seconds into the 
video, the NC photo is present. 


20. On June 20, 2014, the culmination day of the ISIS One Billion 
Campaign, the NC Photo, named “Pic.twitter.com/Ts5mKqsZOc 
campaign billion Muslims to support the Islamic State” was 
tweeted from @ghoulaton Twitter account. 


21. In September of 2014, FBI surveillance also confirmed that 
GHOUL was working at the Snack Attack Convenience Store, located 
on Bragg Blvd, Fayetteville, NC. On November 5, 2014, at the 
Snack Attack convenience store, an FBI surveillance team 
observed a black male matching the individual in the NC Photo. 


€ Twitter is an online news and social networking service where users post and 
interact with messages (also known as “tweets)" restricted to 140 characters. 
Registered users can post tweets, but those who are unregistered can only read 
them. 


S According to the U.S. government organization, Open Source Enterprise, the 


video had received 6,534 views by 0928 GMT on 20 June 2014. 


S 
sa 
1 
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22. 


23: 


24. 


1^ 


This individual was identified (hereinafter referred to as 


“cC.J.”). Through an unrelated investigation, State authorities 
arrested C.J. for Possession of Cocaine with Intent to 
Distribute.” He was subsequently interviewed by FBI. Cod; 


explained that he regularly hung out at the Snack Attack and 
about 4 months prior to his arrest, he met a Middle Eastern male 
who went by “Limbi” (but whom he later identified as GHOUL) who 
began working there. GHOUL had asked C.J. if GHOUL could take 
a picture of him while he was holding a sign that had writing 
on it in Arabic. GHOUL also asked C.J. to hold up his right 
hand with his index finger extended. C.J. was not sure what it 
was all about and didn’t ask. C.J.’s friend (hereinafter 
“A.B.”), was also asked to hold the sign and take a photo, but 
he refused." C.J. recalled having arguments with GHOUL because 
GHOUL believed that ISIS could defeat the U.S. military and he 
also recalled GHOUL as using the store internet and constantly 
watching Youtube and other videos on his phone all day long that 
appeared to be ISIS related. 


GHOUL’s FALSE STATEMENTS AND ATTEMPT TO OBTAIN CITIZENSHIP 


Title 18 U.S.C. §1425(a) makes it a felony to attempt to 
unlawfully procure U.S. naturalization and is satisfied by proof 
of three elements: (1) defendant attempted to procure his 
naturalization; (2) the defendant did so contrary to law (e.g., 
by providing materially false statements); and (3) the defendant 
did so knowingly. 


GHOUL submitted an N-400 Application for U.S. Citizenship on 
or about December 29, 2014. On February 21, 2017, GHOUL 
voluntarily arrived at the Durham, NC, office of USCIS Officer 
Gary Freitas, for an interview in relation to his submitted N- 
400.1 


At the outset of the interview, Officer Freitas administered 
an oath and GHOUL affirmed his answers would be truthful. 
Officer Freitas began the N-400 interview by administering the 
N-400 written, reading and oral civics tests. GHOUL required 
no interpreter and passed these tests. Below are a few of the 


He had previous arrests for Breaking and Entering, Larceny, Possession of 


Stolen Property, and a Felony Probation Violation. 


11 


12 


This was confirmed by A.B. during his interview on January 28, 2015. 


Unknown to GHOUL, this interview was video and audio recorded with the 


consent of Mr. Freitas. 


ee. 
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25; 


13 


questions answered by GHOUL and related facts displaying that 
the answers were false and that GHOUL knew them to be false. 
These are only a few examples, but are believed to be more than 
sufficient for purposes of the presently requested Complaint 
and Arrest Warrant. 


Question #10 - Associations 


GHOUL answered “No” to Question #10, “Have you ever been a 
member of, or in any way associated (either directly or 
indirectly) with: (C) A terrorist organization?”!3 However, 


A. GHOUL’s conduct in creating the NC photo described above 
and then placing it online to further ISIS propaganda 
displays an association with ISIS. 


B. In late 2014, and with no direction other than to attempt 
to get to know GHOUL and report on any suspicious activity, 
the FBI enlisted the assistance of a Confidential Human 
Source (hereinafter “Source#2”). Source#2 struck up a 
conversation with GHOUL at the Snack Attack and thereafter 
began a routine of periodically coming by to chat with 
GHOUL. 


C. On February 6, 2015, GHOUL justified actions by ISIS of 
catching a Jordanian pilot and burning him alive because 
the pilot was an apostate. GHOUL described the video of 


this action: “It’s awesome, magnificent!” In 
justification, GHOUL described Muslim leaders who had 
burned apostates in the past. At one point, in reference 


to ISIS, GHOUL stated, “God willing I shall be with them 
soon.” GHOUL stated that he would like to travel to Raqqa 
and “write about the conquests of the Islamic State, 
creating records for the invasions,” because he is a 
“historian.” 


D. On or about March 3, 2015, Source#2 had a conversation with 
GHOUL in which they discussed the rules of jihad!4, laws of 


CIS officer Freitas explained during the interview that: “Direct association 


would be like a member or you're involved in some way. Indirect association 
means such as communication through another party, or helping in providing food 
or money or funds or anything like that.” 


14 


The Arabic term jihad means simply “to struggle,” however, in context and 


as generally used by Islamic Extremists, it is used to mean violence or war for 
a holy purpose. 
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“Allah” and appropriate punishments.?!° GHOUL informed 
Source#2 that he had written some poetry which they then 
reviewed. The first exalted the “Commander of the 
Faithful” who is a “sword drawn against the non-believers.” 
GHOUL confirmed that he was referencing “al-Baghdadi” the 
leader of ISIS. GHOUL also stated that he supports ISIS 
decapitating persons whom they believe to be spies and that 
Western media lies by stating that these people were 
journalists. During this discussion, GHOUL stated, “The 
West defeated us because of the many collaborators in our 
Midst.” Source#2 stated, “You sell tobacco!” and GHOUL 
replied, “At least I support them, I support them with 
words. I know, I do not do enough. I support them with 
words, by telling the truth.” 


E. During the same conversation, GHOUL went on in reference 
to nonbelievers and confirmed that the edict to kill them 
where you find them “is a general rule for all Muslims.” 


GHOUL stated, “I support the Islamic State. I support 
anything the Islamic State does...Body and soul. If the 
Commander of the Faithful orders me, ‘sell your home and 


get your money,’ I will.” The CHS questioned, “So if he 
says we need money, you will send it to him?” and GHOUL 
replied, “I will send it to him.” In response to questions 
from Source#2, GHOUL also stated, “Allah willing, if I go 
to Tunisia, I will go to Libya...yeah! When the first, 
the first Muslim conquerors arrive, I will be with then, 
Allah willing.” GHOUL explained that America is a country 
of unbelievers (defined as anyone who does not worship 
Allah) and that according to Shari’a, Muslims residing here 
should leave to fight and support the Islamic State, and 
that “to support them means to defend them, to work with 
them, to fight with them.” GHOUL admitted that he does 
not do as much as he should. GHOUL then explained the 
principles of the Islamic Caliphate in which jihad is an 
obligation and that he supports the killing and terror used 
by the Islamic State for it to rise. GHOUL noted that 
three years ago, “I pledged allegiance to the commander of 
the faithful [Abu Bakr al-Baghdadi] to hear and obey 
through thick and thin.” Source#2 challenged whether this 
included even the killing of innocents within the twin 
towers and GHOUL responded that it is allowed and that he 
has pledged his allegiance to this. GHOUL asked Source#2 
to also pledge allegiance, but Source#2 stated he needed 


1> The conversations between Source#2 and Ghoul are in Arabic. The quoted 
conversations have been translated by an FBI contract Linguist. 
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to first receive more explanations and proofs. During this 
conversation, GHOUL also stated that he wanted to obtain 
an American passport so he could “go anywhere.” 


F. On July 17, 2015, GHOUL praised the terrorist attack in 
Chattanooga, TN, (by Muhammed Youseff Abdelazeez)1®, as an 
“Eid ogift A 


G. On November 5, 2015, in the presence of Source#2, GHOUL 
watched an ISIS propaganda video on his phone. The speaker 
in the video stated that he decided to leave Trinidad and 
join jihad to establish Islam. GHOUL later explained that 
those who believe and immigrate and conduct jihad die as 
martyrs and are the true Muslims whereas those who lag 
behind are considered infidels. GHOUL told Source#2 that 
because Source#2 was content with staying behind, he had 
joined the infidel’s camp. In this conversation GHOUL 
noted “at least I am with them.” GHOUL urged Source#2 to 
give up the wealth of this life for the sake of obtaining 
ever-lasting life in the hereafter. Source#2 later 
commented that if the worldly life is to be sold, it has 
to be sold in its entirety. GHOUL responded, “yes, carry 
out a martyrdom operation.” 


H. On May 12, 2016, GHOUL played an Islamic Extremist 
propaganda video for Source#2 that boasted confrontation 
with the U.S. as the will of Allah and exalted the old and 
young who have traveled to Syria and joined in martyrdom 
operations. GHOUL then told Source#2 that the Sheikh was 
speaking to Source#2. GHOUL stated, “go forth to the land 
of honor.” Source#2 questioned how and GHOUL replied, “the 
Sheikh said, deal with it...rely on Allah.” GHOUL then 
stated, “Go to Turkey.” Source#2 pressed for further 
information and GHOUL stated that he should go to Gaziantep 
and “stay at the hotel, I will contact you and when you 
get there you tell what hotel and what your room number 
is, and the brothers will come to you...they will get 
through to go...do you understand?” GHOUL then repeated 
that Gaziantep was a city in Turkey bordering Syria and “I 


16 Muhammad Youssef Abdulazeez opened fire on two military installations in 
Chattanooga, Tennessee, on July 16, 2015. He first committed a drive-by shooting 
at a recruiting center, then traveled to a U.S. Navy Reserve center and continued 
firing, where he was killed by police in a gunfight. Four Marines died on the 
spot. A Navy sailor, a Marine recruiter, and a police officer were wounded; the 
sailor died from his injuries two days later. 


v Eid is a reference to a Muslim holiday. 


i 
eir 
+ 
+ 
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will contact the brothers and they will come to you and 
take you - take you to them over there...you get into the 
land of Islam. You meet the Sheik there.” GHOUL then 
questioned whether Source#2 had any education in science 
or communications. Source#2 told GHOUL that he had a dream 
in which he was wearing white and had blood on him. GHOUL 
stated, “You will die a martyr, or you will undertake a 
martyr suicide operation.” Source#2 asked whether GHOUL 
is joking or serious and GHOUL told him: 


You get a roundtrip ticket, do you 
understand or not? Tourism. YOU! tGO* TONS 
to Istanbul...You stay for three or four 
days in Istanbul; you go and sightsee as if 
you are a tourist; you dress like that and 
shave the beard so that you don’t attract 
attention...In a certain, go catch the 
train and get your ticket to Gaziantep 
without anybody knowing that...move from 
city to city till you reach Gaziantep...In 
Gaziantep, you book a hotel; you live in 
it. A week of time, the guys will come to 
you. 


Source#2 again pressed GHOUL as to whether he was serious 
and GHOUL responded, “I sent 13 people through.” Source#2 
sought clarification and questioned, “Have you ever gotten 
someone through?” GHOUL responded, “Yes, I did, that’s my 
job.” GHOUL went on to tell Source#2 that he would need 
to be careful because there are people that would attempt 
to catch him and put him in jail. Source#2 pressed GHOUL 
on whether GHOUL would let him down if Source#2 were to 
travel. GHOUL responded, “We said that we will stay in 
touch, you understand, don’t you? And I will send the guys 
to you...I will give you the code to talk with them...so 
that you know they are the right people I sent you.” GHOUL 
then told him that a roundtrip ticket to Turkey would be 
about $1,000. Source#2 expressed fear about being caught 
and GHOUL told him to trust in Allah and that even if he 
died on the way to jihad, he would be rewarded. 


. On May 19, 2016, Source#2 told GHOUL that he intended to 


go to Turkey. GHOUL responded that he had made no promises 
but only showed Source#2 what he thought. GHOUL stated 
that Source#2 should not tell anyone and should just go. 
Source#2 stated that he needed more information, but GHOUL 
simply stated that he didn’t know. GHOUL stated that if 
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Source#2 made it to Gaziantep, that he should say that al- 
Battar Tunisi said hello. 


J. Through his interaction with GHOUL, Source#2 learned that 
GHOUL had a Twitter account, @weljaton3, and that he often 
used the name al-Battar al-Tunusi.!8 GHOUL provided 
Source#2 with instructions on the use of Twitter and told 
him about a Twitter account that belongs to a group of the 
Islamic State in Morocco. 


K. The FBI conducted open source searches for other Twitter 
accounts with similar names.’ This search led to Twitter 
accounts with variations of the account name weljaton.” 
The Arabic username transliterated to al-Battar al-Tunusi 
and remained consistent within a number of Twitter accounts 
that used variations of weljaton, indicating that GHOUL 
created new accounts on a regular basis. Additionally, 
the reviewed variations of the weljaton accounts generally 
used the same user profile image. This image is a graphic 
of a hillside upon which stands individuals in possession 
of some form of firearms and an ISIS flag at the top of 
the hill. There is Arabic on the graphic which translates 


1$ Meaning the Tunisian sword or cutter (though it could also be interpreted 
as Tunisian forearm). According to an FBI linguist, “al-Battar” comes from the 
verb “Batara”, meaning amputate or cut a body part. ISIS, and other terrorist 
groups, contextually use “al-Battar” as a man in charge of executing the 
Shari'ah court order which could be beheading (cutting/chopping/striking the 
head) or cutting the hand of a thief. The term is a classical phrase used 
during the early phase of Islam. 

1% Those who violate Twitter’s user policies may have their Twitter accounts 
suspended; this often occurs for those who post violent ISIS propaganda. For 
this reason, these users often create more than one account and these accounts 
often have similarities. In fact, on or about November 16, 2015, the publically 
available portions of an account with a Twitter handle similar to @weljaton3, 
@weljaton23, revealed that the user received a tweet with a justpaste.it link 


to an instructional guide titled “quick Tips for supporters.” Review of this 
guide revealed it contained instructions on how to deal with Twitter account 
closures and steps to follow if your account is closed. The guide instructed 


followers to start completely new accounts and provide step by step instructions 
on how to go undetected by law enforcement. On the first page of the guide in 
the upper corner was an icon that stated in English, “Islamic State Media.” 


2) For example: @weljaton23, @weljaton24, @weljaton59, @we96jaton, @weljaton97, 
etc. 
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to Tunisian Forearm/Sword.** The FBI reviewed the publicly 
available activity of at least 44 variations of these 
accounts in existence between March 2015 and August 2016. 
The activity on these accounts propagated violent action 
and further indicated GHOUL’s association with ISIS. For 
example: 


ii. 


iiis 


D ae 
pw gb 7 Of 


From a review on April 15, 2016, it was disclosed that 
GHOUL provided a self-description on his Twitter 
account @weljaton59: “Extremist, terrorist, tough, 
brain-washed, radical, I love explosions, booby 
trapping, beheading the enemy, and am among the 
supporters of establishing the religion with the 
sword, “22 


On or about June 16, 2016, GHOUL created @weljaton97 
along with a screenshot showing that his previous 
Twitter account (@we96jaton) had been suspended. Next 
to this screenshot of the suspended account, GHOUL 
placed an image of a lion with an ISIS flag that was 
fighting a dog with the U.S. flag and a dog with the 
Turkish flag. Above the screenshot of the suspended 
account, GHOUL tweeted, "We renew our pledge of 
allegiance to the faithful and the Muslim caliph Abu 
Bakr al-Baghdadi, may Allah protect him and enable 
him and his victory on the Shiites and crusaders and 
apostates." 


On or about July 15, 2016, GHOUL used @weljaton130 to 
tweet, “Do not grieve the murder of infidels in Nice 


22 Text appeared originally in Arabic and has been translated above by an FBI 


Linguist. 


233 As previously noted, Abu Bakr al-Baghdadi is the leader of ISIS. 


we 
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but a hypocrite not to kill them but believer 
rejoices.” He went on to tweet, “Praise be to God 
that our hearts rejoice to kill infidels crusaders 
doorstep.” 


iv. In July of 2016, Twitter account @weljatonl141 was 
created. The publicly displayed username for this 
account had the following phone number: 1 910-302- 
9389. This account did not have any tweets or user 
profile image. The 910 area code are commonly 
generated within Eastern North Carolina, to include 
Fayetteville, NC. In November 2016, Your Affiant 
obtained records from T-Mobile and the Fayetteville 
Police Department, which disclosed that the 
associated phone had been stolen and used in Tunisia 
to make international calls to Tunisia, Saudi Arabia 
and Mozambique. Additionally, the phone had been used 
to send text messages to Tunisia, Egypt, and 
Fayetteville, NC. Source#2 also later confirmed that 
GHOUL was using this stolen phone. 


L. The FBI additionally located relevant evidence on other 
online accounts attributable to GHOUL. For example, 


Ie By June of 2014, the Facebook account that had given 
rise to the investigation (account 100006497799532) 
had been removed. Review of Facebook friends for the 
removed account led to discovery of another account: 
www. facebook.com/aboukenda. The displayed username 
for this account, once transliterated and translated, 
was “The cutting sword (formerly Father of Kindah from 
the South).” The profile banner was of a young 
toddler, later assessed to be the daughter of GHOUL 
whose name is Kendah. This Facebook account likewise 
contained indication of terrorist support. For 
example the account profile photo contained the ISIS 
flag, and under the about section listed work as 
“jihad for the sake of Allah” in Arabic. 


24 Presumably this was meant to say something akin to “at our doorstep.” These 
tweets were in support of a terrorist attack that occurred in Nice, France, on 
or about July 14, 2016 in which a tractor trailer truck was driven through a 
large crowd gathered for Bastille Day resulting in approximately 84 individuals 
killed and approximately 256 individuals wounded. The perpetrator of the attack 
was Mohamed Lahouaiej Bouhel. Amaq News Agency, an online presence believed to 
be affiliated with ISIS, called Bouhel “one of the soldiers of the Islamic 
State.” 
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Ii. Open source internet search of the term "HOUCINE 
GHOUL" revealed Google+ account 
105184683951010307919, which has been assessed to be 
another online account used by GHOUL. The account 
photo was of a black ISIS flag and appears to be the 
same photo from the Twitter account for 
@ghoulaton. The account name is "Strict Forearm" 
(machine translated). On August 31, 2014, GHOUL had 
commented on a video that was shared publically from 
this account. The video was titled “Burn ISIS Flag 
Challenge”. GHOUL commented “Im ISIS”. In other 
instances, GHOUL likewise associated himself with 
ISIS. For example, on August 20, 2014, another user 


posted on his Google+ page, “..Six months from now ISIS 
will be down to a single brigade, spending all it’s 
time fighting other takfiris in Syria.” GHOUL 


responded, “Six month from now we will be in your door 
steps-Inshallah.’@° 


Question #22 ~ Other Crimes 


26. GHOUL answered “No” to Question #22, “Have you ever committed, 
assisted in committing, or attempted to commit, a crime or 
offense for which you were not arrested?” However, 


A. On March 3, 2015, Source#2 observed GHOUL tell a female 
customer that he is “king of this neighborhood” and can 
get her anything. The Customer asked whether he has a 
pistol and GHOUL responded, “I sell anything, baby. Do 
you want ten? I sell you ten.” A few months later, on 
May 5, 2016, GHOUL discussed with Source#2 that he had sold 
a hand gun a few months prior for $300. When Source#2 
inquired about ability to get him a gun, GHOUL stated he 
could get a gun for the CHS for between $200 and $500. 


B. On June 13, 2015, a second FBI Confidential Human Source, 
(hereinafter Source#3)**, provided information to the FBI 
that GHOUL was dealing drugs out of the drive thru window 


25 The Arabic term takfiris refers to Muslims who accuse other Muslims of 
apostasy; and the Arabic term inshallah means “God Willing.” 


26 Source#3 was opened as an FBI confidential human source in December 2014. 
Source#3 was arrested for possession of cocaine with intent to distribute and 
received one year of probation. Despite Source#3’s criminal history, the FBI 
deemed Source#3’s reporting to be credible because much of his reporting had 
been corroborated through other sources, interviews, and FBI physical 
surveillance. 
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of the Snack Attack convenience store. Source#3 observed 
that on an unknown date, between June 3 and June 9, 2015, 
an unknown female parked her car in the parking lot and 
left her son in the car. The female came in and asked 
GHOUL if she could purchase some "weed." GHOUL advised 
her to come back later. Source#3 observed GHOUL take a 
stack of scraps of paper from a shelf located above the 
cashier counter. These scraps of papers contained names 
and numbers. GHOUL called one of the numbers and advised 
he had a customer. Later, a Black Male, driving a white 
Mercedes Benz, came through the drive-through and delivered 
a gram of marijuana. GHOUL purchased the marijuana for 
S15: 00: GHOUL later resold the marijuana for $20.00 to 
the female who had come in earlier. 


. On July 17, 2015, GHOUL told Source#2 that he acts as a 


middleman for drug activity at the Snack Attack and profits 
as much as $200 per night. GHOUL stated that he uses the 
store phone to contact a dealer when a store customer makes 
a drug request and that for each transaction, GHOUL 
receives $5. Source#2 observed GHOUL make a call, a drug 
transaction take place, and GHOUL receive $5. 


. On July 24, 2015, Source#2 observed GHOUL charge a customer 


a “tax” in order to sell the customer alcohol prior to the 
NC State permissible hours. 


. During the second half of 2016, Source#2’s interaction with 


GHOUL reduced dramatically because GHOUL had begun working 
at a different convenience store located in Lumberton, NC. 
On November 30, 2016, Source#2 stopped by GHOUL’s home in 
Eastover, NC. GHOUL informed Source#2 that he was unhappy 
at his new job because there was no “hustling” and so money 
was “really tight.” GHOUL claimed that previously, he 
would make around $7,000 a month at the Snack Attack in 
addition to his regular pay. The extra income came from 
such things as overcharging customers and a cut he took 
from the sale of marijuana taking place through the store. 
GHOUL complained that he was now making only about $3,000 
a month. 


. Additionally, as discussed in more detail below, GHOUL 


filed fraudulent U.S. Federal tax returns for tax years 
2015 and 2016. 
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Question #30 - Sham Marriage 


27. 


GHOUL answered “No” to Question #30, E, “Have you ever: 


Married someone in order to obtain an immigration benefit?” 
However, 


A. On December 8, 2015, GHOUL told Source#2 that he had been 


married five times. GHOUL stated that his first wife was 
from Puerto Rico, his second from Ecuador, the third was 
American, the fourth Moroccan, and the fifth one is Tunisian. 
He mentioned that he had married an American woman for the 
sole purposes of obtaining his legal papers and that he had 
been engaged to another woman back in Tunisia. 


. GHOUL’s first wife, M.T., was located and interviewed in late 


2015. She admitted that she had been part of a ring of women 
that were used to marry men for the purposes of obtaining 
U.S. citizenship. She stated that she did not know anyone by 
the name of Houcine Ghoul, but if she had married him, she 
had done it for money and he had done it for U.S. citizenship. 
M.T. denied filing any paperwork for a man named Houcine GHOUL 
and stated that she had not signed the I-130. 


Question #47 - Support U.S. Constitution 


28. 


GHOUL answered “Yes” to Question #47, “Do you support the 


Constitution and form of government of the United States?” 
However, 


A. On March 3, 2015, Source#2 and GHOUL had a discussion 


27 


regarding GHOUL’ s pending citizenship application. Source#2 
mentioned to GHOUL that he would have to swear allegiance to 
the U.S. and GHOUL responded that it would be all talk, but 
what is in the heart is in the heart. GHOUL also expressed 
that the U.S. Constitution is a constitution of the Kufar.?? 
GHOUL commented that the majority of the people are infidels 
in this country and it is a country of infidelity because its 
law is not based on Allah’s law. GHOUL stated that Muslims 
living in the U.S. should leave to fight and support the 
Islamic State. It was during this conversation that GHOUL 
commented on his desire to have an American passport so he 
could “go anywhere.” 


. On December 8, 2015, while GHOUL was showing Source#2 an 


Islamic Extremist video propagating jihad, GHOUL chanted 


The Arabic term Kufar means “unbeliever.” 
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29; 


30. 


oh 


a2, 


-g 


“Terrify them, kill them, destroy them, blow them up, kill 
them, blow them up.” They then began to watch a video of a 
shooting incident in the U.S. and GHOUL began to make 
derogatory comments about the U.S. GHOUL stated “Believe me, 
there is going to be a civil war here, they are going to kill 
each other. I am going to stay another 5 years and get the 
hell out. I’ve had it with this fucking country. 
Catastrophes; catastrophes; loss of fruits, wealth, and 
lives. Since they have allowed gays to marry each other, 
that’s it; then wait for Allah’s punishment, do you understand 
me? Eh?” GHOUL later stated that one should live in one’s 
home country, and wait for the Islamic State to arrive. He 
believed that the Islamic State would soon arrive in Tunisia. 


GHOUL signed the N-400 on page #20 of 21, under penalty of 
perjury, that everything he provided was true and correct. On 
page #21 of 21, GHOUL signed the Oath of Allegiance to the 
United Sates. 


FALSE INCOME TAX FILINGS 


GHOUL’S 2015 and 2016 federal form(s) 1040 U.S. Individual 
Income Tax Return(s) were prepared and filed by Continental Tax 
and Accounting Service, located at 2207 Bragg Blvd. in 
Fayetteville, NC. Each return was electronically filed and 
authorized, under penalties of perjury, by GHOUL and his wife 
M.B.G. 


For the 2015 and 2016 tax years, GHOUL and his wife maintained 
bank accounts at Wells Fargo Bank and Branch Bank and Trust 
(BB&éT). The specific accounts are: 


. Wells Fargo Bank account 73661170XX 
. BB&T account 55960225XxX 
. BB&T account 52087766XxX 
. BB&T account 52057059XX 


aup 


A complete analysis was conducted for each of these bank 


accounts. The analysis included total credits (deposits, 
transfers, etc.) to the account and total debits (debit card 
expenditures, cash withdrawals, etc.) to the accounts. The 


purpose of the analysis was to assist in the bank deposit method 
of proof to determine income that was not reported on the federal 
income tax returns. 
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33. 


34. 


35. 


The bank deposit method of proof is an indirect method of 
proof that is used in computing taxable income and/or, in this 


investigation, adjusted gross income. For each tax year, all 
deposits to GHOUL’s bank accounts were added together to 
determine gross deposits. Any non-taxable items, such as 


transfers between accounts, checks to cash, cash withdrawals, 
were deducted to yield net taxable bank deposits. After the 
net taxable bank deposits were determined then all known cash 
expenditures, or uses of cash, were added back to show the gross 
income amount for each year. 


Title 26 U.S.C. § 7206(1) makes it a felony to submit a 
document signed under penalties of perjury that the subject 
knows is false and requires proof of four elements: 1) the 
person made or subscribed a return, statement or other document 
which was false as to a material matter; (2) the return, 
statement or document contained a written declaration that it 
was made under the penalties of perjury; (3) the maker did not 
believe the return, statement or other document to be true and 
correct as to every material matter; and (4) willfulness. 


GHOUL made and subscribed a return, statement, or other 


document which was false as to a material matter. 


A. GHOUL and his wife, M.B.G., subscribed to 2015 and 2016 
U.S. Individual Income Tax Returns, Forms 1040, that 
GHOUL knew to be false as to the material matters shown 
or proven in the following: 


Tax Year | Adjusted Adjusted Unreported 
Gross Income | Gross Income Adjusted Gross 
Per Tax Per Income 
Return Investigation 


2015 $13,195.00 $53,666.05 $40,471.05 


2016 $11,570.00 $42,396.17 $30,826.17 


B. GHOUL’S 2015 and 2016 tax returns were false to a material 
matter, specifically Line 21, adjusted gross income, on 
the 2015 U.S. Individual Income Tax Return and Line 38, 
adjusted gross income, on the 2016 U.S. Individual Income 
Tax Return. 


C. GHOUL worked for the store known as Snack Attack, located 
at 2916 Bragg Boulevard, in Fayetteville, NC. He was able 


ie 
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36. 


to earn additional income primarily from conspiring with 
local drug dealers conducting drug transactions in the 
store, while he was there. GHOUL told Source#2 that he 
makes about $200.00 per night off of the drug sales. He 
further explained that he gets $5.00 for each marijuana 
sale. Source#2 advised he had observed what he assessed 
to be drug activity at the store. 


The return, statement, or other document contained a written 


declaration that it was made under the penalties of perjury. On 
the following dates, HOUCINE GHOUL along with his wife, M.B.G., 
Signed the respective Form(s) 8879 which contained a written 
declaration that it was made under the penalties of perjury: 


37. 


SE 


A. On February 2, 2016 HOUCINE GHOUL and his wife, M.B.G., 


signed a Form 8879, which is the “IRS e-file Signature 
Authorization.” This form allowed Cecilia Stone of 
Continental Tax and Accounting Service to enter or generate 
the Personal Identification Number (PIN) of both HOUCINE 
GHOUL (665XX) and that of his wife, M.B.G., (438XX) as 
their signatures and authorizations to file their 2015 
individual tax return electronically. 


. On February 8, 2017 and February 10, 2017 respectively, 


GHOUL and his wife signed a Form 8879, which is the “IRS 
e-file Signature Authorization.” This form allowed Barbara 
Mills of Continental Tax and Accounting Service to enter 
or generate the Personal Identification Number (PIN) of 
both HOUCINE GHOUL (665XX) and that of his wife, M.B.G., 
(438XX) as their signature and authorization to file their 
2016 individual tax return electronically. 


GHOUL did not believe the return, statement, or other document 
to be true and correct as to every material matter. 


A. 


GHOUL had control over his bank accounts at Wells Fargo 
Bank and BB&T Bank, therefore knowing that his deposits in 
2015 and 2016 were significantly larger than the adjusted 
gross income reported on his federal individual income tax 
returns. 


. GHOUL stated to Source#2 that when he was working at the 


Snack Attack business he was making approximately $7,000.00 
per month in addition to his regular pay. 
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38. 


Ca 


GHOUL boasted to Source#2, in February of 2016, that he 
had filed his tax return and was receiving an $8,000.00 
refund. Thereby, showing his knowledge of the filed 2015 
individual income tax return. 


. GHOUL stated to SOURCE#3, in November of 2015, that when 


he was working in New York he made about $14,000.00 in 
seven months but in Fayetteville he can make $24,000.00 in 
seven months. 


GHOUL acted willfully. 


A. 


Following a $31,805.00 cash withdrawal, on March 21, 2016 
from his Wells Fargo Bank account, number 7366117047, 
GHOUL, made a $9,000.00 deposit on April 7, 2016; a 
$9,000.00 deposit on April 12, 2016; and a $7,000.00 
deposit on April 18, 2016 into his savings account, number 
5596022598, at BB&T. These transactions are indicative of 
his knowledge about a reporting requirement for banks 
involving currency transactions over $10,000.00. 


. GHOUL internationally wired $27,700.00 that was broken down 


into three separate $9,900.00 wires on July 6, 2016; July 
19, 2016; and August 5, 2016. The funds were available 
within the accounts but GHOUL kept the transactions under 
the $10,000.00, indicating his knowledge of a reporting 
requirement. 


. On September 15, 2015, FBI was notified by Customs and 


Border Patrol (CBP) that GHOUL’s wife, M.B.G., had departed 
the US from Newark Liberty International Airport, Newark, 
NJ. Prior to her boarding the airlines, she was contacted 
by CBP and found to be in possession of approximately 
$21,601.00 U.S. Currency which she was then asked to 
declare. 


. On August 15, 2016, GHOUL and his wife, M.B.G., departed 


the US from Washington D.C. Dulles International Airport. 
Prior to boarding the airlines, they were contacted by CBP. 
GHOUL claimed to be in possession of $8,000 in US Currency. 
GHOUL was found to be in possession of approximately 
$9,500.00 in US Currency. 
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E. On multiple occasions, Source#2 witnessed GHOUL conduct a 
drug transaction or a transaction in which GHOUL received 
cash over and above the sale of an inventoried item. GHOUL 
would then write down his portion of the cash on a scrap 
piece of paper (similar to a ledger type recording). The 
total cash was placed in the register but GHOUL recorded 
the cash that was owed him so he could remove and retain 
his portion from the proceeds when he closed out the 
register. He referred to this money as his captures.?8 


F. GHOUL reported $13,195.00 and $11,570.00 in Adjusted Gross 
Income on the respective 2015 and 2016 U.S. Individual 
Income Tax Returns. The income that was reported 
represented his salary earned and reported from the Snack 
Attack business. However, he willfully failed to report 
the additional income in the amounts of $40,471.05 for tax 
year 2015 and $30,826.17 for tax year 2016. Consequently, 
he failed to report approximately 75% of his Adjusted Gross 
Income in 2015 and 72% of his Adjusted Gross Income in 
2016. 


G. On one occasion, GHOUL asked Source#2 if he paid taxes. 
When Source#2 asked why, GHOUL stated “When you pay taxes, 
your money goes to the evil tyrants and infidels.” GHOUL 
further stated “I don’t pay taxes.” GHOUL did not pay 
taxes in 2015 or 2016. As a result of Earned Income 
Credit(s) and Additional Child Tax Credit(s), GHOUL 
received refunds in the amount of $8,021.00 for 2015 and 
$5,579.00 for 2016. 


****REMAINDER OF PAGE INTENTIONALLY BLANK**** 


22 On June 30, 2017, in a debrief of Source#2, when asked about GHOUL 
overcharging customers, Source#2 advised that GHOUL would overcharge certain 
customers, specifically military members and drug addicts. Ghoul referred to 
this in Arabic as “Ghana’im” meaning war captures or his spoils of war. 
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39. 


I, 


CONCLUSION 


WHEREFORE, your affiants respectfully assert that the above 
information displays sufficient basis for this Court to issue a 
Criminal Complaint against and Arrest Warrant for HOUCINE BECHIR 
GHOUL, a/k/a HOUCINE GHOUL, a/k/a LIMBI GHOUL, for violations 
of 18 U.S.C. § 1425(a) and Title 26 U.S.C. § 7601(1). 


Amber L. Kilker, duly sworn according to law, affirm that the 


facts stated in this affidavit are true and correct to the best of 
my knowledge, information, and belief. 


€ 


-@ 


Special Agent Amber L. Kilker 
Federal Bureau of Investigation 


I, 


Kevin Green, duly sworn according to law, affirm that the 


facts stated in this affidavit are true and correct to the best 


of my knowl 


Special Agent Kevin Greene 


ge,ginformation, and belief. 


Internal Revenue Service 


Tur 


AM DETA Ree sna REVIN GAENE 


appeared before me via reliable electronic means, was placed 


under oath, 


U.S. 


contents of the Affidavit. 


. GATES 
GISTRATE JUDGE 
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